NordVPN says one of its servers was breached in March 2018, exposing some of the browsing habits of customers who were using the VPN service to keep their data private. NordVPN says the server, located in Finland, did not contain activity logs, usernames, or passwords. But the attacker would have been able to see what websites users were visiting during that time, a company advisor said, although the content of the websites likely would have been hidden due to encryption.
Over the past couple years, NordVPN has become a lot more popular as it’s gone on a heavy advertising push. You’ll often hear NordVPN ads in the middle of podcasts, or find a YouTube host pausing to talk about how NordVPN can protect your privacy by masking your browsing habits. The company has positioned its product, which sends your traffic through servers in other cities or countries to mask your browsing habits, as an easy way to maintain your privacy online, but the server breach could detract from that promise for potential customers.
“Potential attackers could have gotten only into that server and only intercept the traffic and seen what websites people are browsing – not the content, only the website – for a limited period of time, only in that isolated region , ”Tom Okman, a member of NordVPN’s tech advisory board, toldThe Verge.
Okman says NordVPN usually changes the server each user is connected to every five minutes or so, but that users get to pick which country they are connecting through. That means users likely would have only been impacted for intermittent periods of time. The breach also could have only impacted users who were connecting through Finland, which is where the breached server was located.
Details of the breach started circulating over the weekend by security researchers.In a blog post this morning, NordVPN said it has known about the breach for “a few months,” but did not immediately disclose the problem because the company wanted to audit the rest of its systems. The flaw was limited to a single server, NordVPN says. The data center installed a remote access system on the server, without telling the VPN provider, and that system was insecure, allowing an outsider to gain access, according to the blog post.
The server was vulnerable between January 31 st, 2018 and March (th, 2018, but NordVPN believes it was only breached once, during March.
NordVPN says information taken from the server couldn’t have been used to decrypt traffic on any other server. It acknowledges that a stolen encryption key, which is now expired, could have been used to perform a man-in-the-middle attack, with the hacker disguising themselves as a NordVPN server. But NordVPN says such an attack would have to be “personalized and complicated” and apply to a single person at a time.
No other data centers were affected, NordVPN says, and it has cut ties with the company that maintained the flawed server.
Okman says the company doesn’t believe any information was taken, but that NordVPN will be informing its customers of the breach by email. “I would not call this a hack,” Okman said. “This is an isolated security breach – hack is too powerful a word in this case.”
GIPHY App Key not set. Please check settings